brutespray

No entries match these filters. Clear filters

1. v2.7.2 Aug 25, 2026 · issue 057

   brutespray v2.7.2 adds engagement manifests, deterministic dry-run planning, lockout-aware budgets, and authenticated audit chains

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.7.2 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.7.2

   └──▷ TRY IT
   Generate and save a reviewable execution plan from an Nmap scan before any credentials are attempted — useful for change-control or CI gating.
   copy

   $ brutespray -f nmap.gnmap --dry-run --plan-out engagement-plan.json

   Run the actual spray only after the plan hash has been reviewed and acknowledged, preventing credential substitution attacks between review and execution.
   copy

   $ brutespray -f nmap.gnmap --require-plan-ack <plan-hash>

   Define lockout-safe spraying policy and evidence mode in an engagement manifest so every run inherits the same budget and audit settings.
   yaml copy

   lockout_threshold: 5
   lockout_window: 30m
   safe_margin: 1
   jitter_percent: 10
   evidence:
     mode: hash
     hmac_key: "<your-hmac-key>"

   • Adds --dry-run flag to resolve targets and credentials into deterministic JSON without performing any authentication attempts.
   • Adds --plan-out flag to write the full execution plan to a file for review, approval, or CI evidence.
   • Adds --require-plan-ack flag to require that the exact reviewed plan hash matches before execution proceeds; binds credential contents via keyed HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. so same-sized credential-list substitutions invalidate the plan.
   • Adds brutespray audit verify subcommand requiring BRUTESPRAY_AUDIT_HMAC_KEY; missing or incorrect keys fail verification with a fail-closed exit.
   • Adds evidence.hmac_key field in the engagement manifest as a required key for acknowledged execution and audit-chain verification.

   +10 more show less

   • Adds lockout_threshold, lockout_window, safe_margin, and jitter_percent policy controls in engagement manifests for lockout-aware attempt budgets, with shared scheduling across worker pools.
   • Adds engagement manifests (YAML) carrying engagement identity, authorization references, scope, lockout policy, and evidence defaults.
   • Adds allow/deny scope controls — host and CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. allowlists plus explicit deny rules applied before execution; rejected targets appear in dry-run output with stable reasons.
   • Adds evidence modes full, redacted, hash, and reserved encrypted for machine-readable credential output; hash mode emits HMAC-SHA256HMAC-SHA256A keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. correlation values without printing the secret.
   • Adds JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. workspace store for durable engagement records without requiring CGO or an external database, with new workspace command paths for initialization and inspection.
   • Adds declarative YAML HTTP auth templates describing HTTP/API authentication flows without enabling arbitrary shell execution; invalid or unsafe templates fail before network execution.
   • Adds a canonical service descriptor registry covering default ports, aliases, credential modes, routing support, module parameters, stability, and wordlist aliases.
   • Adds token-aware execution for InfluxDB v2 — tokens are attempted once per token without multiplication across default usernames; use -m mode:v1 to preserve username/password pair generation.
   • Normalizes lockout-budget account identities to service|domain|user across worker pools instead of resetting per goroutine.
   • Adds authenticated audit chains using HMAC-SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. chaining instead of a recomputable plain hash; sensitive artifacts (checkpoints, session logs, stores, audit files) use owner-only permissions.

   15 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !--require-plan-ack requires an engagement manifest with evidence.hmac_key set; executions using plan acknowledgment without this key will fail closed.
   • !brutespray audit verify requires the BRUTESPRAY_AUDIT_HMAC_KEY environment variable; missing or incorrect keys cause verification to fail.
   • !-P is now a strict print-and-exit operation in the shared Execute path; any setup that relied on -P continuing into credential attempts will no longer do so.
2. v2.6.3 Jun 28, 2026 · release notes

   brutespray v2.6.3 adds operator diagnostics, attempt status taxonomy, module panic recovery, and smarter skip/resume/scheduling controls.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.3 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.6.3

   └──▷ TRY IT
   Audit a credential spray run without exposing raw passwords in debug logs — useful for sharing diagnostics with a team.
   copy

   $ brutespray -f targets.gnmap --debug-audit --debug-file audit.jsonl -u users.txt -p passwords.txt

   Diagnose routing issues (wrong interface, proxy mis-selection) before a large spray by printing per-target route info.
   copy

   $ brutespray -f targets.gnmap --route-diagnostics -u admin -p password

   Use a host-major queue order with aggressive connection-failure skipping to finish live hosts first and avoid dwelling on dead ones.
   copy

   $ brutespray -f targets.gnmap --schedule host-major --skip-policy aggressive --max-conn-fails 3 -u users.txt -p passwords.txt

   • Adds --debug-audit and --debug-file flags to write per-attempt JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. diagnostics with passwords redacted and credential substrings scrubbed from error text.
   • Adds --route-diagnostics flag to print selected local/source route info per target (interface, bound local IP, proxy context); disables TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. so output stays visible.
   • Adds --module-help <service|all> flag to introspect default port, credential mode, module params, and wrapper gating for any protocol module.
   • Adds --skip-policy auto|off|conservative|aggressive and --max-conn-fails to tune when repeated connection failures skip a host/service.
   • Adds --schedule auto|host-major|spray|pairwise to control credential queue ordering for deterministic or spray-style execution.

   +7 more show less

   • Introduces stable machine-readable attempt status codes (auth_success, auth_failure, connection_failure, unsupported_service, module_timeout, module_panic_recovered, skipped_service) propagated through JSONL output, session logs, TUI, and resume paths.
   • JSONL attempt output now includes an additive status_code field alongside the legacy status field.
   • Module boundary protection: panicking protocol modules are now caught and recorded as module_panic_recovered instead of crashing the entire run.
   • Timeout containment: modules that ignore context cancellation no longer block host completion; the attempt is recorded as module_timeout.
   • Granular checkpoint resume now uses a count-based per-host cursor to skip already-attempted queue prefixes on partially completed hosts.
   • Adds OpenAI-compatible research provider support for wordlist research via WORDLIST_RESEARCH_PROVIDER, WORDLIST_RESEARCH_MODEL, and WORDLIST_RESEARCH_URL environment variables (enables vLLM and similar endpoints).
   • RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. Sticky-Keys detection upgraded with broader detectTerminalWindow logic covering cmd.exe, PowerShell, and custom shell colors via pixel brightness delta and bounding-box fill analysis.

   12 details in Everything

3. v2.6.3 Jun 28, 2026 · issue 001

   brutespray v2.6.3 adds skip/schedule policies, debug audit logging, route diagnostics, module help, panic recovery, and stable attempt status codes.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.3 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.6.3

   └──▷ TRY IT
   Tune host-skip behaviour during a large scan so aggressive connection failures don't stall a run, while keeping spray-mode lockout awareness intact.
   copy

   $ brutespray -f nmap.gnmap --skip-policy aggressive --max-conn-fails 3 -u admin -p passlist.txt

   Write redacted per-attempt diagnostics to disk for post-engagement review without exposing raw passwords in logs.
   copy

   $ brutespray -f nmap.gnmap -u root -p passlist.txt --debug-audit --debug-file audit.jsonl

   Inspect a protocol module's default port, credential mode, and accepted params before targeting it.
   copy

   $ brutespray --module-help rdp

   • Adds --skip-policy auto|off|conservative|aggressive and --max-conn-fails to tune when repeated connection failures cause a host/service to be skipped.
   • Adds --schedule auto|host-major|spray|pairwise to select deterministic credential queue ordering.
   • Adds --debug-audit and --debug-file to write per-attempt JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. diagnostics with passwords and credential substrings redacted.
   • Adds --route-diagnostics to print selected interface, bound local IP, and proxy context per target (disables TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. so output stays visible).
   • Adds --module-help <service|all> to introspect default port, credential mode, module params, and wrapper gating for any protocol module.

   +5 more show less

   • Introduces stable machine-readable attempt status codes (auth_success, auth_failure, connection_failure, unsupported_service, module_timeout, module_panic_recovered, skipped_service) propagated through JSONL output, session logs, and TUI.
   • Adds module boundary protection: panicking modules are caught and recorded as module_panic_recovered; hung modules are capped and recorded as module_timeout.
   • Adds granular count-based per-host resume cursor so interrupted runs skip already-attempted queue prefixes on partially completed hosts.
   • Supports OpenAI-compatible endpoints (e.g. vLLM) for wordlist research via WORDLIST_RESEARCH_PROVIDER, WORDLIST_RESEARCH_MODEL, and WORDLIST_RESEARCH_URL environment variables.
   • Enhances RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. sticky-keys detection with broader detectTerminalWindow logic covering cmd.exe, PowerShell, and custom shell colors.

   10 details in Everything

4. v2.6.2 May 29, 2026 · release notes

   brutespray v2.6.2 adds SSH bad-key detection, pre-auth RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. recon, stdin pipeline support, 5 new DB modules, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. tiering, and inline creds.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.2 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.6.2

   └──▷ TRY IT
   Check SSH targets for known-bad/default keys only (no password spray) — ideal for quick exposure triage after a scan.
   copy

   $ masscan -p22 10.0.0.0/24 -oJ - | brutespray --badkeys-only

   Brute-force multiple services using inline credential pairs without creating a file, slotting into a live recon pipeline.
   copy

   $ naabu -p 5984,9200,8086 -host 10.0.0.0/24 | fingerprintx | brutespray -c 'admin:admin,root:changeme,elastic:'

   • Adds SSH bad-keys pre-pass: embedded Rapid7 ssh-badkeys corpus (plus Vagrant, F5, Barracuda, and others) compiled into the binary, with CVE-tagged metadata and BADKEY/type:badkey output; controlled via --no-badkeys and --badkeys-only.
   • Adds pre-auth RDP recon (brute.ScanRDPRecon): X.224 NLA fingerprinting without authentication, plus sticky-keys backdoor detection (T1546.008) when NLA is not enforced; disable with --no-rdp-scan.
   • Adds stdin pipeline ingestion: auto-detects naabu, Nerva URI/JSON, fingerprintx JSON, and masscan -oJ formats when no -f or -H is supplied, enabling chains like naabu | fingerprintx | brutespray.
   • Adds five new database brute-force modules: CouchDB (5984), Elasticsearch (9200), InfluxDB (8086, v1/v2 via -m mode:v1), Neo4j (7687, Bolt v5), and Cassandra (9042, CQL native), bringing total service count to 41.
   • Adds SNMP community-string tiering via -m mode:default|extended|full (20/55/92 entries), with full covering SCADA, IP camera, and storage-array defaults.

   +3 more show less

   • Adds -c/--creds flag for inline credential pairs ('user:pass,user2:pass2') without requiring a file.
   • Adds new TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. Findings tab populated from pre-auth recon results, color-coded by severity (INFO/WARN/HIGH/CRITICAL).
   • Adds Finding and KeyMatch fields to BruteResult, surfaced in text, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. (type:finding), and TUI output.

   8 details in Everything

5. v2.6.1 May 3, 2026 · release notes

   brutespray v2.6.1 adds a -delay flag for intuitive per-attempt throttling in slow brute-force scenarios.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.1 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.6.1

   └──▷ TRY IT
   Throttle SSH brute-force to one attempt every 10 seconds to evade rate-limiting or lockout policies, without calculating a fractional rate.
   copy

   $ brutespray -file nmap.xml -service ssh -delay 10s

   • Adds -delay duration flag (e.g. -delay 10s) as an ergonomic alternative to fractional -rate values for slow brute-force scenarios.
   • Updates -rate help text to clarify fractional values are supported (e.g. -rate 0.1 = one attempt every 10 s).
   • Adds govulncheck CI workflow scanning all Go dependencies against the Go vulnerability database on every push/PR and weekly.
   • Adds dependency-review action that blocks PRs introducing dependencies with known moderate-or-higher severity vulnerabilities.
   • Monthly wordlist update with new SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. credential overrides.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Using both -delay and -rate together exits with an error — they are mutually exclusive.
6. v2.6.0 Mar 17, 2026 · release notes

   brutespray v2.6.0 adds 12 new service modules, SSH key auth, CSRFCSRFCross-site request forgery, an attack that makes a signed-in browser send an unwanted request to a site. The site may accept the request using the victim's existing session. extraction, SNMPv3, proxy rotation, and multi-auth support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.6.0 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.6.0

   └──▷ TRY IT
   Test SSH private-key authentication against discovered SSH hosts instead of passwords.
   copy

   $ brutespray -f hosts.gnmap -s ssh -U users.txt -m key:true -p /path/to/id_rsa

   Brute-force a login form that uses CSRF tokens — brutespray will extract the token automatically each attempt.
   copy

   $ brutespray -f hosts.gnmap -s http-form -U users.txt -P passwords.txt -m csrf:csrf_token -m url:/login -m userfield:username -m passfield:password

   Rotate through multiple SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxies round-robin to distribute spray traffic across exit nodes.
   copy

   $ brutespray -f hosts.gnmap -s ssh -U users.txt -P passwords.txt --proxy-list proxies.txt

   • Adds 12 new service modules: SVNSVNApache Subversion, an open-source centralized version control system maintained by the Apache Software Foundation, used by tools to track, branch, and merge source code changes across a shared repository., SOCKS5-auth, HTTP-form, HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.-form, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure.-VRFY, rexec, rlogin, rsh, wrapper, FTPSFTPSFTP with TLS/SSL encryption layered on top, standardized in RFC 4217, used by tools that need to transfer files over authenticated, encrypted channels while staying compatible with legacy FTP infrastructure., LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. — bringing the total to 35+.
   • Supports SSH private-key authentication via -m key:true -p /path/to/id_rsa.
   • Enables automatic CSRF token extraction for HTTP-form attacks via -m csrf:FIELD_NAME.
   • Adds SNMPv3 user-based authentication with MD5/SHA and AES/DES privacy.
   • Supports multi-auth auto-detection: HTTP Digest/NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent., SMTP PLAIN/LOGIN/NTLM, IMAP CRAM-MD5, POP3 APOP (from banner), and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. pass-the-hash.

   +6 more show less

   • Introduces --proxy-list for round-robin rotation across multiple SOCKS5 proxies.
   • Adds SOCKS5 CONNECT handshake verification before handing off to modules.
   • Modules now capture and return server banners in BruteResult.
   • Supports database and domain parameters: MySQL/PostgreSQL -m dbname:NAME, MSSQL/RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely./SMB -m domain:NAME, Redis -m db:N.
   • Replaces default help output with a grouped, color-coded help menu organized by category.
   • Telnet module now recognizes login/password prompts in 10 languages including Chinese, Japanese, Korean, and Russian.

   11 details in Everything

7. v2.5.5 Mar 6, 2026 · release notes

   brutespray v2.5.5 promotes RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. to stable, adds session replay on resume, and hardens credential handling for special characters and CRLF injection.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.5 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.5.5

   └──▷ TRY IT
   Resume a previously interrupted scan — Ctrl+C now prints the exact command; pass either the .json or .jsonl.jsonlA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. session file and brutespray resolves it automatically.
   copy

   $ brutespray --resume session.jsonl

   • RDP support promoted from beta to stable.
   • Session replay on --resume: the full previous session is replayed into the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. so the scan appears uninterrupted.
   • Ctrl+C now prints the exact --resume command needed to continue a session later.
   • Connection string escaping for credentials containing @, :, ;, etc. across MongoDB, MySQL, PostgreSQL, MSSQL, and Oracle.
   • CRLF injection prevention: credentials are sanitized before embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. in Asterisk AMI, TeamSpeak, VMAuthd, and NNTP protocol streams.

   +1 more show less

   • New docs/ folder with seven dedicated documentation pages covering installation, usage, services, examples, TUI, advanced options, and output.

   6 details in Everything

8. v2.5.4 Mar 6, 2026 · release notes

   brutespray v2.5.4 adds an interactive TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., embedded wordlists, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS. modules, credential spray mode, and resume support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.5.4 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.5.4

   └──▷ TRY IT
   Run a spray attack against a target list with a delay between attempts to avoid lockouts, saving a checkpoint you can resume if interrupted.
   copy

   $ brutespray -f targets.xml -spray -spray-delay 2s -resume

   Generate a Metasploit resource script and a NetExec shell script from results, then fall back to classic console output for CI pipelines.
   copy

   $ brutespray -f targets.xml -summary -rate 5 --no-tui

   • New default interactive TUI (Bubble Tea) with tabbed views: All, By Host, By Service, Completed, Successes, Errors, Settings; use --no-tui to revert to legacy output.
   • Live-adjustable threads-per-host and parallel-hosts settings during an active scan via the TUI Settings tab.
   • Real-time stats in TUI: elapsed time, attempts/sec, success rate, and error counts.
   • Embedded curated wordlists compiled into the binary via a YAML manifest — no external downloads required.
   • Automated monthly wordlist refresh pipeline with Brave Search integration.

   +10 more show less

   • New LDAP and LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. bruteforce module.
   • New WinRM bruteforce module.
   • Metasploit .rc resource script output via -summary.
   • NetExec/CrackMapExec shell script output via -summary.
   • Resume/checkpoint support: automatically saves progress on Ctrl+C; resume with -resume.
   • YAML config file support (-config) for per-engagement settings.
   • Per-host rate limiting via -rate.
   • SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support routed through a centralized ConnectionManager for all modules.
   • Interface binding (-iface) for VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. and multi-homed network setups.
   • RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. module upgraded with LoginAuthOnly() for fast NLA-only credential checking and full context/timeout support.

   15 details in Everything

9. v2.4.2 Feb 16, 2026 · release notes

   Brutespray v2.4.2 adds Redis brute-force support including Redis 6.0+ ACLACLAn access control list, a set of rules allowing or denying operations for particular users, services or network addresses. It decides who can use a resource. auth across all input formats.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.4.2 https://github.com/x90skysn3k/brutespray.git
   # already have the repo? check out this version:
   $ git checkout v2.4.2

   • Adds Redis brute-force module targeting port 6379, with support for Redis 6.0+ ACL username/password authentication.
   • Supports Redis targets across all input formats: GNMAP, JSON, XML, Nexpose, Nessus, and list files.

   2 details in Everything

10. v2.4.0 Aug 8, 2025 · release notes

    Brutespray v2.4.0 adds HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. brute force, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. domain auth, no-color CI output, and a revamped concurrency engine.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/x90skysn3k/brutespray.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ TRY IT
    Run a brute force campaign in CI with no-color output for clean log ingestion.
    copy

    $ brutespray -f nmap.xml -s ssh -U users.txt -W passwords.txt --no-color | tee brutespray.log

    • Adds HTTP/HTTPS brute force support with dedicated wordlists for web authentication attacks.
    • Adds RDP domain authentication support for domain-joined target brute forcing.
    • Adds no-color output option for clean logging in CI/CD pipelines and log aggregation.
    • Revamps threading and concurrency system for improved parallelism across concurrent hosts.
    • Implements a performance monitoring and metrics module.

    5 details in Everything

11. v2.3.1 Jan 8, 2025 · release notes

    brutespray v2.3.1 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support, interface selection, and centralized connection management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.1 https://github.com/x90skysn3k/brutespray.git
    # already have the repo? check out this version:
    $ git checkout v2.3.1

    • Adds SOCKS5 proxy support for routing credential-spray traffic through a proxy.
    • Adds interface selection option to control which network interface is used for connections.
    • Introduces centralized connection management for improved control over concurrent service connections.

    3 details in Everything

12. v2.2.1 Feb 27, 2024 · release notes

    v2.2.1 adds -P flag to print found hosts, and support for XMPP, Teamspeak, and Oracle DB protocols

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.1 https://github.com/x90skysn3k/brutespray.git
    # already have the repo? check out this version:
    $ git checkout v2.2.1

    └──▷ USE IT
    Run a bruteforce scan and immediately output the list of discovered hosts to stdout using the new flag.
    shell copy

    brutespray -f nmap_output.txt -P

    Target specific services including newly supported protocols like XMPP and Oracle DB.
    shell copy

    brutespray -f hosts.txt -s xmpp,oracle_db,teamspeak

    • Adds -P CLI argument to print found hosts during scanning
    • Adds support for the XMPP protocol in service maps
    • Adds support for the Teamspeak protocol with adjusted timeout handling
    • Adds experimental support for Oracle DB detection

    4 details in Everything